Hello. Im trying to reverse from scratch my motrcycle ECU - BOSH BMSC (BMW F650GS).
This is pretty simple ECU, works without MAF\MAP, only Lamba, throttle pos and rev sensor (+ temperature and pressue sensor in addition).
It has 68HC16Z2 inside it.
Only disasm what working with HC16 core i could find is IDA Pro, but it generate mess with HC16 address extension registres.
More details or if you wanna help here:
https://reverseengineering.stackexchang ... er-in-hc16Also HC16 has dynamic internal ROM\RAM mapping, what makes IDAs analyzer insane.
Maybe there is another HC16 disasms?
PS i have expirience with MCU, but not with ECUs and engine control.
Where i can get info about, what i must find inside code? I can detec HW interraction and some system stuff vectable and etc.
But what must find? Spark table, injection time control, more?
